# California Made Every Injured User a Plaintiff **Author:** Sushee Nzeutem, SVRNOS **Published:** May 23, 2026 **Category:** Governance **Canonical URL:** https://svrnos.com/insights/ca-sb-243-private-right-of-action **Hero image:** https://svrnos.com/insights/ca-sb-243-private-right-of-action/ca-sb-243-private-right-of-action-title.png > California SB 243 took effect January 1, 2026. Private right of action with $1,000 per violation minimum. UCL personal-liability pairing. The audit trail is now a plaintiff's discovery target. --- ![California Made Every Injured User a Plaintiff - SB 243 effective January 1, 2026](/insights/ca-sb-243-private-right-of-action/ca-sb-243-private-right-of-action-title.png) California's companion chatbot law came out of the same [documented failure pattern](https://svrnos.com/insights/companion-ai-harm) as New York's: companion AI platforms deployed at scale with weak AI disclosure, weak crisis routing, and weak harm detection for users in distress. The [GER taxonomy](https://svrnos.com/research/governance-error-register) names those failures: 401, [404](https://svrnos.com/insights/ger-404-replika), [501](https://svrnos.com/insights/ger-501-tumbler-ridge). Senate Bill 243 took effect on January 1, 2026. The structural difference from New York is who enforces it. [New York's Article 47](https://svrnos.com/insights/ny-companion-law) gives the Attorney General enforcement authority. California's SB 243 gives injured users enforcement authority. A person who suffers injury in fact as a result of noncompliance can sue for injunctive relief, reasonable attorneys' fees and costs, and damages equal to the greater of actual damages or $1,000 per violation. That changes the economics. A user's claim no longer has to be large enough on actual damages alone. The statute supplies the floor. The fee provision supplies the litigation incentive. The audit trail supplies the evidence. Every injured California user is now a potential plaintiff. ## What the Law Requires **AI disclosure.** When a reasonable person could be misled into thinking the chatbot is human, the operator must provide a clear and conspicuous notification that the chatbot is artificially generated and not human. For known minors, the operator must also provide recurring notices during extended use, including reminders that the chatbot is AI and that the user should take breaks. **Suicide and self-harm safety protocols.** Operators must implement protocols to detect and respond to expressions of suicidal ideation or self-harm. Crisis service referrals must be issued during the interaction. Not after review. Not after escalation. During the interaction. **Minor-specific safeguards.** When the operator knows the user is a minor, additional protections apply, including break reminders during extended use and restrictions on sexually explicit content. **Annual safety reporting.** Beginning July 1, 2027, operators must report annually to California's Office of Suicide Prevention on the number of crisis referrals issued and the protocols implemented to detect, remove, and respond to suicidal ideation. The Office posts the data publicly. ![California SB 243 - the audit trail becomes a plaintiff's discovery target](/insights/ca-sb-243-private-right-of-action/ca-sb-243-private-right-of-action.png) ## What Comes Next California is the first major US companion-chatbot law with a private right of action. [New York's Article 47](https://svrnos.com/insights/ny-companion-law) entered effect November 5, 2025, with AG enforcement and civil penalties of up to $15,000 per day. [Oregon's SB 1546](https://svrnos.com/insights/oregon-sb-1546) and [Washington's distress-routing mandate](https://svrnos.com/insights/wa-distress-routing-mandate) both take effect January 1, 2027. Other states are moving in the same direction. For operators of companion apps, mental-health chatbots, and emotionally responsive AI products, California's bar is now the floor in the largest state economy in the country. The operator is the entity making the companion chatbot platform available to California users. Using a third-party model underneath does not make the operator disappear. A platform that cannot document compliance is exposed to a plaintiff filing in a California court on the next reported incident. ## The Audit Trail Becomes Discovery Under New York, the audit trail proves compliance to a regulator. Under California, the audit trail becomes a plaintiff's discovery target. Every governance event the system logged. When it logged it. What it detected. What it failed to detect. When it acted. Whether it routed. Whether the disclosure fired. Whether the user was a known minor. Whether the minor protections applied. All of it becomes evidence. If the log is incomplete, the gap is the case. That changes what infrastructure has to do. It is no longer enough to say the model had a policy. It is no longer enough to say the platform had a safety page. It is no longer enough to say the company cared about user protection. The system has to flag the signal. Route the response. Disclose the AI. Apply the minor safeguards. Produce a record that survives subpoena. ## The Litigation Map Gets Wider SB 243 creates the direct companion-chatbot cause of action. Pair it with California's broader consumer-protection environment and plaintiff-side theories can move beyond the platform entity toward people who authorized, directed, or controlled the challenged conduct. That does not erase the corporate form. It widens the litigation target map. For founders, product leaders, and platform operators, the question is whether the company can prove the required safeguard was present, active, and functioning when the interaction occurred. ## The Infrastructure Question The audit asks: did the safeguard execute when the law required it? Is there a record of the route? That proof requires infrastructure. [Sango Guard](https://kingsango.com) provides the governance layer for operators that need to meet California's disclosure, safety, and minor-protection obligations at the architectural level: real-time compound signal detection for suicidal ideation, configurable session disclosure triggers, age-aware policy enforcement for minor accounts, and an audit trail for every governance event. The detection layer runs continuously. The disclosure layer is configurable per operator. The minor-protection layer applies policy based on account status and operator configuration. The audit trail gives counsel, compliance teams, and litigation defense a record of what the system detected, when it acted, and what route was triggered. The law is live. The plaintiffs are coming. The compliance infrastructure exists. → [Book a King Sango demo](https://kingsango.com) --- ## Sources - [California Senate Bill 243 — California Legislative Information](https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB243) - [California Companion Chatbot Law Now in Effect — Perkins Coie](https://perkinscoie.com/insights/update/california-companion-chatbot-law-now-effect) - [New York and California Enact Landmark AI Companion Laws — Morrison Foerster](https://www.mofo.com/resources/insights/251120-new-york-and-california-enact-landmark-ai) - [California's SB 243 Mandates Companion AI Safety and Accountability — Jones Walker](https://www.joneswalker.com/en/insights/blogs/ai-law-blog/ai-regulatory-update-californias-sb-243-mandates-companion-ai-safety-and-accoun.html)